2017

The *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Bin

IBM Business Process Manager 8.5.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbit

IBM Security Identity Manager Adapters 6.0 and 7.0 stores user credentials in plain in clear text which can be read by a

IBM Business Process Manager 7.5, 8.0, and 8.5 temporarily stores files in a temporary folder during offline installs wh

IBM WebSphere MQ 8.0 could allow an authenticated user to cause a premature termination of a client application thread w

geminabox (aka Gem in a Box) before 0.13.7 has CSRF, as demonstrated by an unintended gem upload.

geminabox (aka Gem in a Box) before 0.13.6 has XSS, as demonstrated by uploading a gem file that has a crafted gem.homep

logger.c in the logger plugin in WeeChat before 1.9.1 allows a crash via strftime date/time specifiers, because a buffer

Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual edi

Before version 4.8.2, WordPress was susceptible to an open redirect attack in wp-admin/edit-tag-form.php and wp-admin/us

Before version 4.8.2, WordPress was vulnerable to cross-site scripting in oEmbed discovery.

Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb->prepare, and thus di

Before version 4.8.2, WordPress allowed a Directory Traversal attack in the Customizer component via a crafted theme fil

Before version 4.8.2, WordPress allowed Cross-Site scripting in the plugin editor via a crafted plugin name.

Before version 4.8.2, WordPress allowed a Cross-Site scripting attack in the template list view via a crafted template n

Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive

Before version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link modal via a javascript: or

Stack-based buffer overflows in CyberLink LabelPrint 2.5 allow remote attackers to execute arbitrary code via the (1) au

In EPESI 1.8.2 rev20170830, there is Stored XSS in the Tasks Description parameter.

In EPESI 1.8.2 rev20170830, there is Stored XSS in the Tasks Title parameter.

In EPESI 1.8.2 rev20170830, there is Stored XSS in the Tasks Alerts Title parameter.

In EPESI 1.8.2 rev20170830, there is Stored XSS in the Phonecalls Subject parameter.

In EPESI 1.8.2 rev20170830, there is Stored XSS in the Phonecalls Description parameter.

In EPESI 1.8.2 rev20170830, there is Stored XSS in the Tasks Phonecall Notes Title parameter.

Foxit Reader 8.3.2.25013 and earlier and Foxit PhantomPDF 8.3.2.25013 and earlier, when running in single instance mode,

DenyAll WAF before 6.4.1 allows unauthenticated remote attackers to obtain authentication information by making a typeOf

DenyAll WAF before 6.4.1 allows unauthenticated remote command execution via TCP port 3001 because shell metacharacters

NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEs

NVIDIA GPU Display Driver contains a vulnerability in the kernel mode layer handler where a value passed from a user to

NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer handler for DxgkDdiCreateAllocation

NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer handler for DxgkDdiCreateAllocation

NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEs

NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEs

NVIDIA GPU Display Driver contains a vulnerability in the kernel mode layer handler where an incorrect initialization of

NVIDIA GPU Display Driver contains a vulnerability in the kernel mode layer handler where improper access controls could

Proxy command injection vulnerabilities in Trend Micro Mobile Security (Enterprise) versions before 9.7 Patch 3 allow re

Authentication bypass vulnerability in Trend Micro Mobile Security (Enterprise) versions before 9.7 Patch 3 allows attac

Unrestricted file uploads in Trend Micro Mobile Security (Enterprise) versions before 9.7 Patch 3 allow remote attackers

SQL Injection vulnerabilities in Trend Micro Mobile Security (Enterprise) versions before 9.7 Patch 3 allow remote attac

Vulnerability issues with the web service inspection of input parameters in Trend Micro Web Security Virtual Appliance 6

Command injection vulnerability in Trend Micro Smart Protection Server (Standalone) 3.1 and 3.2 server administration UI

CA Identity Manager r12.6 to r12.6 SP8, 14.0, and 14.1 allows remote attackers to potentially identify passwords of lock

Privilege escalation vulnerability in LXCA versions earlier than 1.3.2 where an authenticated user may be able to abuse

An attacker who obtains access to the location where the LXCA file system is stored may be able to access credentials of

IrfanView 4.44 - 32bit allows attackers to cause a denial of service or possibly have unspecified other impact via a cra

STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, rel

STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafte

STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, rel

STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafte

STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafte